[2026-08-14T20:39:15,484027447+00:00] Upload SBOM
INFO: Using mounted CA bundle: /mnt/trusted-ca/ca-bundle.crt
'/mnt/trusted-ca/ca-bundle.crt' -> '/etc/pki/ca-trust/source/anchors/ca-bundle.crt'
Using token for quay.io/redhat-appstudio-qe/group-f2i2/go-component-uqde29
Pushing sbom to registry
[retry] executing: cosign attach sbom --sbom sbom.json --type spdx quay.io/redhat-appstudio-qe/group-f2i2/go-component-uqde29:on-pr-788c568cbd2fe4f0e224acb9cc0052c11030bf27@sha256:54e2f70744d61182bf399dfcedd8fc6d342cc0c6bcd2599ea53a3ce5d3c4c6e1
WARNING: SBOM attachments are deprecated and support will be removed in a Cosign release soon after 2024-02-22 (see https://github.com/sigstore/cosign/issues/2755). Instead, please use SBOM attestations.
WARNING: Attaching SBOMs this way does not sign them. To sign them, use 'cosign attest --predicate sbom.json --key <key path>'.
Uploading SBOM file for [quay.io/redhat-appstudio-qe/group-f2i2/go-component-uqde29@sha256:54e2f70744d61182bf399dfcedd8fc6d342cc0c6bcd2599ea53a3ce5d3c4c6e1] to [quay.io/redhat-appstudio-qe/group-f2i2/go-component-uqde29:sha256-54e2f70744d61182bf399dfcedd8fc6d342cc0c6bcd2599ea53a3ce5d3c4c6e1.sbom] with mediaType [text/spdx+json].

quay.io/redhat-appstudio-qe/group-f2i2/go-component-uqde29@sha256:b82ac96c09578de77a74ac6b334cb64aaa19c127b1572e3acbf7977c71bb4293
[2026-08-14T20:39:44,846597523+00:00] End upload-sbom